Phishing messages follow a recognizable structure regardless of the specific story they tell: they impersonate a sender you likely recognize, apply some form of pressure, and direct you toward an action — clicking a link, opening an attachment, replying with information, or calling a number. Learning to spot that underlying structure holds up better over time than memorizing any particular scam script, since the surface details change constantly while the shape underneath does not.
Display-name deception versus the real sender address
An email or message app shows a display name chosen entirely by whoever sent the message — it can say “Bank Support,” “IT Department,” or a real colleague’s name, regardless of the actual underlying address. Checking the full sender address, not just the display name, is the first concrete step: in Gmail, tapping or clicking the sender name expands the full address; in Outlook and on many phones, a similar tap or long-press reveals it. A mismatch between a familiar display name and an unfamiliar address is a meaningful signal on its own.
Reply-to differences
A closely related but separate detail is the reply-to address, which can be set independently of the sending address. A message can appear to come from one address in your inbox list while any reply you send is routed somewhere else entirely. Checking this requires actually starting a reply (without sending it) and looking at where it would go, or viewing the message’s full headers if your email client supports that. A reply-to address unrelated to the apparent sender is a reason to verify further, not conclusive proof of anything on its own — legitimate mailing services, support ticketing systems, and delegated third-party providers can also use a different reply-to address for entirely ordinary operational reasons. Treat a mismatch here as one more data point to weigh alongside the others in this guide, not as an automatic verdict.
Urgency and pressure as a structural signal
Phishing messages frequently create time pressure: an account closing within hours, a payment overdue today, a security issue requiring immediate action. This pressure serves a specific function — it discourages the kind of careful checking described throughout this guide. Treating urgency itself as a signal, independent of whatever the message claims to be urgent about, is a useful habit: a genuinely time-sensitive matter from a real organization can typically also be verified through a separate, independently found channel without meaningfully increasing your risk of missing a real deadline.
Requests for credentials, codes, or payment
Three specific requests deserve heightened scrutiny wherever they appear: a request to enter a password on a page reached via a link rather than navigated to directly; a request to share a one-time verification code with anyone, since legitimate systems generate these for you to use yourself, not to hand to another party; and a request for payment through a channel that is difficult to reverse — gift cards, wire transfers, or cryptocurrency. None of these requests is inherently proof of a scam in isolation, but each is a request legitimate organizations make only in narrow, specific circumstances, and each deserves independent verification before acting.
Unexpected attachments and links
An attachment or link you were not expecting, from a sender you do recognize, deserves the same caution as one from an unfamiliar sender — compromised accounts send messages that look entirely ordinary to the people receiving them. Before opening an attachment, consider whether the sender would plausibly send this specific type of file unprompted; before clicking a link, preview its actual destination using the method in How to Tell Whether a Link Is Safe Before You Click.
Buttons and styled links hide the underlying address
A link styled as a button — a colored rectangle reading “Verify Now” or “View Invoice” — visually obscures the destination in a way plain text does not. A plain-text link at least partially reveals its target before you click; a button hides it entirely behind the click itself unless you use a preview method. Where possible, treat button-style links with the same or greater caution as plain ones, and preview the destination regardless of how the link is styled. Reading the actual registrable domain behind any link, once previewed, follows the same method described in How to Read a URL: Every Part Explained in Plain English — a domain unrelated to the organization the message claims to represent is a stronger signal than any visual styling detail.
Business email compromise style messages
A distinct pattern involves messages impersonating a colleague, manager, or vendor rather than an outside company — requesting an urgent wire transfer, a change to payment details, or a purchase of gift cards on the sender’s behalf. A message like this can arrive timed around when the impersonated person would plausibly be unavailable to confirm by phone, and can include a request to keep the matter confidential or act quickly — both patterns that, when present, work against the verification that would reveal the deception, though this guide makes no claim about how often any of these specific elements appear. The practical response does not depend on that frequency: any unusual payment or account-change request, even from an apparently familiar sender, warrants verification through a phone number or channel you already have on file — not one provided in the message itself. In a workplace setting specifically, report the message to your employer’s IT or security team through their own established reporting channel — an internal phishing-report button or a known contact — rather than replying to the message or forwarding it casually.
Mobile-interface limitations
Phones complicate several of the checks above. Screen space often truncates sender addresses and link previews, making the address-checking step harder to perform casually. Many mobile mail apps show a large, prominent display name and a small or hidden full address by default. Long-press previews for links work inconsistently across apps, and some in-app browsers used by messaging and social apps do not show a full address bar at all. None of this means phishing is unrecognizable on mobile — it means the checks described here often take one extra deliberate step (tapping to expand a name, long-pressing rather than tapping a link) that is easy to skip when moving quickly, which is worth building into a habit rather than relying on catching visually at a glance.
A hypothetical example, worked through
The following is a hypothetical scenario, not a real incident. A text reads: “Your package could not be delivered due to an unpaid fee. Pay $2.99 here: [link].” Working through the structure: this is unsolicited if no delivery was expected, applies mild financial pressure over a small, easy-to-dismiss amount — a detail sometimes used deliberately to lower scrutiny — and directs you to an unfamiliar link rather than the courier’s own tracking system. None of these signals individually proves the message is fraudulent, but together they describe the general pattern this guide addresses, and checking tracking directly through the courier’s official app or site, reached independently, resolves the ambiguity without needing to click the link at all.
Safe independent verification
Where a message claims to be from an organization you have a real relationship with, verifying independently means using contact information you already have — a number on a card, statement, or the organization’s known official site typed in directly — rather than anything provided in the message. This single habit resolves a wide range of ambiguous cases without requiring you to fully evaluate every technical detail of a suspicious message.
What to do after replying, clicking, downloading, or entering information
The appropriate response depends specifically on what happened, not on the message itself:
- If you replied, review exactly what that reply disclosed — an email signature can reveal a phone number, job title, or workplace details, and a manual reply may show the sender that the address is monitored. It does not prove that the device or account is compromised, and an automated reply does not establish that a person read the original message. Stop further engagement with the thread, and block or report the sender where your email provider supports it. If the message targeted you at work, report it through your employer’s established IT or security channel. This does not mean every reply causes a compromise — it means the details above are worth reviewing deliberately rather than assuming a reply with no obviously sensitive content requires no further thought at all.
- If you clicked a link but entered nothing, close the page and check the browser’s downloads and recently granted site permissions if you are unsure what happened. A security scan is more relevant if something downloaded or ran, a permission was granted, or the browser or device began behaving unexpectedly; merely viewing an ordinary page does not by itself establish that the device was infected.
- If you entered a password, change it immediately on the real site, reached independently, and anywhere else it was reused.
- If you downloaded and opened a file, disconnect the device from the network and run a full scan with updated security software.
- If you entered payment information, contact your card issuer or bank promptly to discuss disputing the charge.
- If you shared a one-time verification code, act immediately to secure the associated account, since that code may have been the last barrier protecting it.
See What to Do After Clicking a Suspicious Link for the fuller, ordered version of these steps.
What this guide does not claim
Polished writing, correct spelling, and professional formatting do not establish that a message is legitimate — phishing messages vary widely in production quality, and treating good writing as a safety signal is itself a vulnerability worth being aware of. Equally, this guide does not claim that grammar mistakes are a required or defining feature of phishing; some messages contain them, many do not, and neither presence nor absence should be relied on as a primary indicator.
Attachment types worth extra caution
Certain attachment types warrant particular caution because of what they can be configured to do when opened. Executable files deserve scrutiny for what they are. Documents or spreadsheets that prompt you to “enable macros” or “enable content” to view them properly are worth a pause — a legitimate document does not typically require enabling macros just to be read — though macros themselves are an ordinary, widely used feature in office documents, and a macro prompt is not proof that a specific file is malicious; it is a prompt worth pausing on given who sent it and whether you expected it. Compressed archive files (such as .zip) present a different, more general consideration: an archive can contain files whose real type or behavior is not obvious from the archive listing alone, and its contents are not always visible or inspectable until you extract them. None of this means every attachment of these types is dangerous; it means these specific formats deserve a version of the same question applied to links — did you expect this, from this sender, in this format — before opening it.
Frequently asked questions
How do I report a phishing email or text?
In the United States, forward phishing emails and report scams at ReportFraud.ftc.gov. In the United Kingdom, forward suspicious emails to [email protected] and suspicious texts to 7726, per official UK guidance.
Can a targeted message include accurate personal details?
Yes — information gathered from other sources, including previous data breaches, can be woven into a targeted message to make it more convincing. Accurate personal details reduce but do not eliminate the value of the structural checks described above.
Is it safe to unsubscribe from a suspicious email?
CISA’s guidance on suspicious messages is direct: don’t click on any attachment or link, including an “unsubscribe” link — just delete the message. If a message is already suspicious for other reasons, deleting or blocking it directly, without interacting with any link inside it, is the simpler and more contained response.
